Formal Methods For A Robust Domain Name System